ISO 27001 Mandatory Documents and Records: The 14-Item List, What Stage 1 Reads, and Who Signs Each

By our count, ISO/IEC 27001:2022 requires documented information at 14 points in clauses 4 to 10. In our classification, six are documents that describe how the ISMS is designed, seven are records that show it ran, and one is both (the internal audit programme and its results). Annex A adds more only when your Statement of Applicability makes a control necessary. Finding the list is easy. The harder questions are which entries a Stage 1 auditor reads first, which ones the standard ties to a named role, and which ones need dated history before you can book the audit at all.

This guide turns the list into an audit tool. Each clause gets one row: document or record, the role the standard names (it names very few), the audit stage that first tests it, and the document in our ISO 27001 toolkit that covers it.

Who needs the full list, and where to start

In plain terms: if you want an accredited certificate, all 14 clause items are required, and the Annex A items follow your own risk decisions.

Your situation	What the list means for you	Write first
Preparing for first certification	All 14 clause items, plus the Annex A items your SoA marks as necessary	Scope (4.3), then the risk assessment process (6.1.2)
Already certified, facing surveillance	The six documents must stay current; the records must keep accumulating	Next internal audit and management review records
Using ISO 27001 to structure NIS2 work	The list comes from the standard, not from NIS2; map it before you rely on it	See how ISO 27001 and NIS2 line up

The 14 mandatory items: clause, type, approver, audit stage

By our reading of clauses 4 to 10, the standard ties only three of the 14 items to a role that establishes, approves or reviews them, and three evidence items are read at Stage 1, not left to Stage 2: the risk assessment results (8.2), the internal audit results (9.2) and the management review results (9.3). Our count follows the clause-by-clause list published by TCSA, which counts “roughly 14” places where the standard “explicitly states documented information shall be available or retained”; other lists merge or split items. The “First tested” column is our reading of the Stage 1 checklist in a certification body’s written procedure, described in the Stage 1 section below: items that procedure names for Stage 1 are marked Stage 1; the procedure is silent on the others, and we assign them to Stage 2.

Clause	Mandatory item	Document or record	Role the standard names	First tested (our reading)	Toolkit doc
4.3	ISMS scope	Document	None named	Stage 1	Doc 67
5.2	Information security policy	Document	Top management (establishes)	Stage 1	Doc 04
6.1.2	Risk assessment process and criteria	Document	None named (risk owners are identified here)	Stage 1	Doc 05
6.1.3	Risk treatment process and treatment plan	Document	Risk owners (approve plan, accept residual risk)	Stage 1	Docs 05, 07, 08, 10
6.1.3 d)	Statement of Applicability	Document	None named	Stage 1	Doc 57
6.2	Information security objectives	Document	None named	Stage 1	Doc 68
7.2	Evidence of competence	Record	None named	Stage 2	Docs 55, 70
8.1	Operational planning and control	Record	None named	Stage 2	Policies 11–34 and their registers
8.2	Risk assessment results	Record	None named	Stage 1	Docs 06, 09
8.3	Risk treatment results	Record	None named	Stage 2	Docs 07, 08, 10
9.1	Monitoring and measurement results	Record	None named	Stage 2	Docs 46, 47
9.2	Internal audit programme and results	Both: programme document, results record	None named	Stage 1	Docs 71, 56, 66
9.3	Management review results	Record	Top management (reviews)	Stage 1	Doc 69
10.2	Nonconformities and corrective action results	Record	None named	Stage 2	Doc 52

The column that changes project plans is “First tested”. An internal audit report and management review minutes cannot be drafted the week before the audit, because each records an event that has to have happened. Both sit on the Stage 1 side in the procedure we follow, which requires one complete cycle by Stage 1, so plan the first full internal audit cycle before Stage 1 and confirm your certification body’s rule. “None named” does not mean nobody approves: clause 7.5.2 still requires approval, as the signatures section explains.

Document or record? Read the verb in the clause

ISO/IEC 27001:2022 does not sort its requirements into documents and records; it calls all of them “documented information”. The distinction still matters, and the clause wording tells you which one you are holding.

• “Shall be available as documented information” marks a living document. Clause 4.3 ends with “The scope shall be available as documented information”, as High Table’s clause 4.3 guide reproduces it. The policy (5.2) and objectives (6.2) belong to the same group: kept current and versioned.
• “Retain documented information about the … process” also marks a document, despite the verb. Clauses 6.1.2 and 6.1.3 use it for the risk assessment and risk treatment processes, per High Table’s 6.1.2 text. Your risk assessment methodology is this document.
• “Retain documented information of the results” and “available as evidence of” mark records. Clause 8.3 says the organisation “shall retain documented information of the results of the information security risk treatment”, as High Table’s 8.3 guide quotes; the items under 7.2, 8.2, 9.1, 9.2, 9.3 and 10.2 are records of the same kind.

The practical difference lies in clause 7.5.3, which lists both “control of changes (e.g. version control)” and “retention and disposition”, as Hicomply’s clause 7.5 summary sets out. A document gets a new version when reality changes. A record is never rewritten. You correct it with a new record, and you decide how long to keep it. In practice, management review minutes edited months after the meeting invite exactly the question you do not want at an audit.

Two clauses can widen the set of documented information beyond the 14 items. Clause 8.1 asks for enough documented information to show that your processes ran as planned, and clause 7.5.1 b) adds whatever documented information you decide is necessary for the ISMS to be effective. Treat the second one with care. Stage 2 checks that you follow your own procedures, so every optional procedure you write becomes a commitment an auditor can test. Fewer, accurate procedures beat a binder of aspirations; our document control guide covers how to keep the set small and current.

Who signs each: three items with a named role, and clause 7.5.2 for the rest

The standard ties three of the 14 items to a named role, and only one of those is an approval in the strict sense: the risk owners’ sign-off under 6.1.3 f). Everything else needs approval too, but you choose the approver and record that choice.

• Top management establishes the information security policy (clause 5.2). TCSA describes it as “the top-level policy approved by leadership”.
• Risk owners approve the risk treatment plan and accept the residual risk. Clause 6.1.3 f) requires the organisation to “obtain risk owners’ approval of the information security risk treatment plan and acceptance of the residual information security risks”, per High Table’s clause 6.1.3 text. Clause 6.1.2 is where those risk owners are first identified.
• Top management reviews the ISMS (clause 9.3), and the results of those reviews are one of the mandatory records.

For every other item, clause 7.5.2 requires documented information to go through review and approval when it is created or updated, as Hicomply’s summary describes it, without saying whose approval. Close that gap in writing: name an approver per document in a role matrix, give documents a version history and records a retention period. In the table below, the first two rows carry roles the standard names; the last three are our practical recommendations.

Role	Signs or owns	Common mistake
Board / top management	Policy (5.2), management review decisions (9.3); in our toolkit also the scope, objectives and the go/no-go decision	Leaving the review to the ISMS lead, so the minutes show no top-management decisions
Risk owners	Treatment plan approval and residual-risk acceptance (6.1.3 f)	The ISMS lead signing for every risk owner, which leaves 6.1.3 f) unmet
CISO / ISMS lead	Drafts and maintains most documents; owns the SoA in practice	Approving their own documents with no second reviewer
Internal auditor	Audit programme and results (9.2)	Auditing processes they run themselves
HR	Evidence of competence (7.2)	Training records that stop at onboarding

What Stage 1 actually reads

Stage 1 is a documentation and readiness review, not a test of whether controls work. The clearest public description we found is the written ISMS assessment procedure of STQC IT Certification Services, a certification body on India’s government domain stqc.gov.in. Its Stage 1 team performs “a detailed review of the applicant’s ISMS documentation” and reviews:

• the scope, checked for consistency with business processes, and at least one Statement of Applicability per scope of certification;
• the risk analysis, the information security policy and objectives, and management responsibilities;
• evidence that internal audits and management reviews are planned and performed. The procedure states that “at-least one complete cycle of internal audit and management review covering the entire scope” must be completed;
• applicable regulations, ISMS procedures, and interfaces with activities outside the scope.

According to that procedure, Stage 1 takes 1 to 4 days of team effort depending on organisation size, and non-compliances found at Stage 1 must be corrected before Stage 2. Stage 2 then confirms that the organisation “adheres to its own policies, objectives and procedures” and that the ISMS is effective. Other certification bodies word their procedures differently, so ask yours for its Stage 1 checklist before you book. One check in the STQC procedure deserves attention: the team confirms that the risk assessment and treatment extend to the boundaries of the certified scope, and that this is reflected in the scope and the SoA. An SoA that covers a site your ISMS scope statement excludes fails that check.

When we built the toolkit’s Certification-Readiness Checklist (Doc 63), we put the internal audit and management review rows in the Stage 1 section for this reason. The internal audit checklist guide covers how to run that first cycle.

Annex A items that become mandatory once your SoA includes them

Annex A controls create documentation duties only through your Statement of Applicability. Clause 6.1.3 d) requires the SoA to list the necessary controls and to justify excluding any Annex A control. Once a control is in, its wording becomes testable, and several controls cannot be met without a written artefact. Advisera’s 2022 list names ten such controls and notes that they are “mandatory only if there are risks or requirements from interested parties that would demand implementing those controls”.

Annex A control	What must exist	Document or record	Toolkit doc
A.5.9 Inventory of assets	Inventory of information and associated assets	Document	Doc 18
A.5.10 Acceptable use	Rules for acceptable use of assets	Document	Docs 17, 34
A.5.26 Incident response	Incident response procedure	Document	Docs 48, 49
A.5.31 Legal and contractual requirements	List of legal, regulatory and contractual requirements	Document	Doc 62
A.5.37 Operating procedures	Security operating procedures for IT	Document	Your own runbooks; SoA row in Doc 57
A.6.2 and A.6.6 Employment terms, NDAs	Security responsibilities in contracts; confidentiality agreements	Document	Docs 33, 44
A.8.9 Configuration management	Defined security configurations	Document	Docs 11, 22
A.8.15 Logging	Logs of user activities, exceptions and security events	Record	Doc 21
A.8.27 Secure engineering principles	Secure system engineering principles	Document	Doc 31

Lists differ. TCSA’s version also includes topic-specific policies (A.5.1), access control rules (A.5.15), supplier agreements (A.5.20), continuity plans (A.5.29), backup records (A.8.13) and change records (A.8.32). The safe reading is to plan a written artefact for every SoA row whose control asks for rules, procedures, agreements, an inventory or logs. Excluding one of these controls is allowed, but the exclusion needs a written justification in the SoA, as our Statement of Applicability template guide explains.

Three things that look mandatory but are not

Procedures for document control, internal audit and corrective action. Advisera lists all three among “non-mandatory” documents. The requirements in clauses 7.5, 9.2 and 10.2 are mandatory; a written procedure for each is optional, though many organisations keep one.

A climate change document. ISO/IEC 27001:2022/Amd 1:2024, published in February 2024, is one page long and listed by ISO at no charge. As SAI Global’s summary puts it, organisations must “determine whether climate change is a relevant issue” (clause 4.1) and acknowledge that interested parties can have climate-related requirements (clause 4.2). The IAF decision on the amendment treats it as “a clarification rather than a new requirement”. The determination itself is required; neither the amendment wording nor the IAF decision asks for a separate climate document. Even so, clause 4.3 says the scope must consider the 4.1 issues, so record the determination, relevant or not and why, in the scope document. Our Doc 67 has a row for it.

An ISMS manual. TCSA states that an ISMS manual is “NOT required by ISO 27001:2022 at all”. A scope document, a policy and an SoA cover what a manual used to hold.

FAQ

How many mandatory documents does ISO 27001:2022 require?

By our count, clauses 4 to 10 require documented information at 14 points: six documents (scope, policy, risk assessment process, risk treatment process including the treatment plan, SoA, objectives), seven records and the internal audit programme and results, which is both. Annex A items come on top only when your SoA includes the control. Other lists give different totals because they merge or split items.

Is the risk treatment plan a mandatory document?

In practice, yes. Clause 6.1.3 requires the organisation to formulate the plan and to obtain risk owners’ approval of it, and Advisera lists the plan as a mandatory document.

Which ISO 27001 documents does a Stage 1 auditor check?

In the STQC procedure, the Stage 1 team reviews the scope, the risk analysis, the policy and objectives, the Statement of Applicability, management responsibilities and applicable regulations. It also checks that internal audits and management reviews have been performed, so those two records must exist before Stage 1, and the risk analysis on that list, which we read as covering your risk assessment results (8.2).

Did Amendment 1:2024 add a mandatory document?

No. It added wording to clauses 4.1 and 4.2: determine whether climate change is a relevant issue, and note that interested parties can have climate-related requirements. It did not add a mandatory document, and the IAF treats it as a clarification rather than a new requirement. Record the determination in the scope document so the auditor can see it was made.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

For the full certification path, costs and timeline, return to the ISO 27001 compliance guide.

Sources

1. TCSA. ISO 27001 Mandatory Documents — clauses 4–10, SoA-driven Annex A items and documents auditors expect. tcsa.in
2. Advisera 27001Academy. List of mandatory documents required by ISO 27001 (2022 revision). Advisera Expert Solutions
3. High Table. ISO 27001 Clause 4.3 — Determining the scope of the information security management system. hightable.io
4. High Table. ISO 27001 Clause 6.1.2 — Information security risk assessment. hightable.io
5. High Table. ISO 27001 Clause 6.1.3 — Information security risk treatment. hightable.io
6. High Table. ISO 27001 Clause 8.3 — Information security risk treatment. hightable.io
7. Hicomply. ISO 27001:2022 Requirements — Clause 7.5 Documented information. hicomply.com
8. STQC IT Certification Services. ISMS Assessment procedure ISMS/P05, Issue 04 (21 February 2025). stqc.gov.in
9. ISO. ISO/IEC 27001:2022/Amd 1:2024 — Amendment 1: Climate action changes, catalogue record. International Organization for Standardization
10. International Accreditation Forum. IAF-ISO Joint Communiqué and IAF Final Decision on the addition of climate change considerations to management systems standards (2024). iaf.nu
11. SAI Global Assurance. Climate change updates to ISO management system standards. saiassurance.com.au